Description
A vulnerability was found in SourceCodester Simple Student Information System 1.0. This affects an unknown part of the file searchquery.php. Performing a manipulation results in sql injection. The attack can be initiated remotely.
Published: 2026-10-06
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: SQL injection leading to unauthorized data access
Action: Apply update
AI Analysis

Impact

The vulnerability resides in an undisclosed portion of the searchquery.php script in SourceCodester Simple Student Information System 1.0. By supplying a crafted input value, an attacker can inject arbitrary SQL statements into the database query. This type of flaw can allow the attacker to read, modify or delete sensitive data stored in the backend database, thereby compromising confidentiality and integrity of the student information system.

Affected Systems

SourceCodester Simple Student Information System version 1.0 is affected.

Risk and Exploitability

The flaw carries a CVSS score of 6.9, indicating a moderate severity, and is exploitable remotely through the web interface. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the injection by sending requests to the vulnerable endpoint from any remote location, provided they can reach the application over HTTP or HTTPS.

Generated by OpenCVE AI on October 6, 2026 at 08:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update to the latest version of SourceCodester Simple Student Information System after applying vendor‑released patches for the searchquery.php component
  • Review the source code of searchquery.php and replace all string‑contructed SQL statements with parameterized queries or properly escape all user inputs
  • Restrict network access to the application by configuring a web‑application firewall or limiting inbound traffic to trusted IP ranges

Generated by OpenCVE AI on October 6, 2026 at 08:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 06 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 07:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in SourceCodester Simple Student Information System 1.0. This affects an unknown part of the file searchquery.php. Performing a manipulation results in sql injection. The attack can be initiated remotely.
Title SourceCodester Simple Student Information System searchquery.php sql injection
First Time appeared Sourcecodester
Sourcecodester simple Student Information System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:sourcecodester:simple_student_information_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester simple Student Information System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Sourcecodester Simple Student Information System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-13T04:52:53.921Z

Reserved: 2026-10-05T20:40:10.029Z

Link: CVE-2026-105807

cve-icon Vulnrichment

Updated: 2026-10-06T12:54:24.608Z

cve-icon NVD

Status : Deferred

Published: 2026-10-06T08:16:36.840

Modified: 2026-10-06T15:04:52.637

Link: CVE-2026-105807

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-06T08:30:18Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')